API Keys

You can manage keys from Workspace Settings or your Profile, depending on the key type.

Key Types

Skilder provides three types of API keys:

Workspace Keys are best for shared agents and automated systems where individual user identity is not important.

User Keys are best when you need per-user audit trails or when the agent acts on behalf of a specific user.

Runtime Keys are managed automatically — you do not need to create or manage them manually.

Creating an API Key

Workspace Keys

1. Click your avatar (top-right) > Workspace Settings.
2. Select the API Keys tab.
3. Click Generate New Key.
4. Enter a description and click Create.
5. Copy the key immediately — it starts with WSK_ and is shown only once.

User Keys

1. Click your avatar (top-right) > Profile.
2. Select the API Keys tab.
3. Click Generate New Key.
4. Enter a description and click Create.
5. Copy the key immediately — it starts with USK_ and is shown only once.

Revoking a Key

When a key is compromised or no longer needed, revoke it:

1. Open Workspace Settings (for workspace keys) or Profile (for user keys) and select the API Keys tab.
2. Find the key and click Revoke.
3. Confirm the action.

Revocation is immediate. Any agent using the key loses access instantly. This action cannot be undone — you must generate a new key if you need to restore access.

Best Practices

Use descriptive names

Name keys after their purpose or the agent that uses them. "Slack Support Bot - Production" is better than "Key 1". You will thank yourself when reviewing keys months later.

One key per agent

Give each agent its own API key. This lets you revoke access for a single agent without affecting others, and makes audit logs easier to read.

Rotate keys regularly

Periodically create new keys and retire old ones. This limits the blast radius if a key is leaked without your knowledge.

Monitor usage

Review which keys are active and when they were last used. Revoke keys that have been inactive for an extended period.

Permissions Model

When an agent connects with an API key, it can access skills through the hats in the workspace:

API Key → Workspace → Hats → Skills → Tools

The agent discovers hats and their skills. Each hat groups a set of skills, and each skill provides access to specific tools. To limit what an agent can access, organize skills into separate hats and assign hats to the appropriate teams. You can also use separate workspaces for different teams or environments.